{"action":"Upgrade nokogiri to 1.12.5 or later.","affected":[{"fixed":"1.12.5","introduced":"0"}],"component":"nokogiri","cve_ids":["CVE-2021-41098"],"ecosystem":"RubyGems","epss":0.0146,"exploited":false,"fixed_versions":["1.12.5"],"ghsa_id":"GHSA-2rr5-8q37-2w7h","id":"tcs_01M5KEG0VCZZAKNZWSPCKXBN7Y","modified_at":"2026-07-08T06:28:52.471678359Z","published_at":"2021-09-27T20:12:47Z","references":["https://osv.dev/vulnerability/GHSA-2rr5-8q37-2w7h","https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h","https://nvd.nist.gov/vuln/detail/CVE-2021-41098","https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml","https://github.com/sparklemotion/nokogiri"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-2rr5-8q37-2w7h","url":"https://osv.dev/vulnerability/GHSA-2rr5-8q37-2w7h"}],"summary":"Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby"}